In this video, we get to take a closer look at the wonderful world of an event
handler.
And on the 40 analyzer, when you hear the word event handler, I like to think
of the analogy
of a security guard with a set of rules. And those rules are what the security
guard is following.
So if the security guard, for example, sees this or this or that, or these four
or five things in a
specific order, security guard then takes action and does something. Well, an
event handler on the
40 analyzer does that with log information that's coming in based on a set of
rules, which are part
of each and every single event handler based on those rules, it can then go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of each and every single event handler based on those rules, it can then go
ahead and take action.
And one of those actions, as in the name, is to go ahead and create an event.
And that way,
we can see that event. And then furthermore, we could take that information and
we could take
those events and create incidents like a case or a ticket to follow up. And if
we want to,
we also have event handlers that could automatically take that next logical
step and create a ticket
or an incident for us to follow up with. So again, in this video, we're going
to focus on the
wonderful world of event handlers and a couple of options regarding event WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
wonderful world of event handlers and a couple of options regarding event
handlers exist. Number
one, we have a whole bunch of prebuilt event handlers, like lots and lots of
them. We'll take a look
at them here in just a moment. And some are considered basic event handlers.
And the basic event handler
has a bunch of rules, actually one or more rules. And if any of those rules are
matched,
it triggers that event handler and it creates an event. And that's a basic
event handler.
And there's also a super fancy event handler is called a correlation event
handler. And a
correlation event handler isn't looking for just like matching on any rule is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
correlation event handler isn't looking for just like matching on any rule is
looking for a sequence
of events or conditions that happen, for example, within five minutes, or
within two minutes, or
with three or four specific log types or messages popping up all related to
each other. When that
happens, it can go ahead then and create an event. So in either case, whether
it's a basic
or a correlation event handler, the goal of these handlers is to based on the
log information,
create events for us. So let's take a closer look here at the 40 analyzer at
our event handlers.
So here we are back at the 40 analyzer. And to see our event handlers, we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here we are back at the 40 analyzer. And to see our event handlers, we're
going to go into
instance and events in this version of the 40 analyzer. And under incidents and
events, we're
going to go to the event handlers. And just as a reminder, if we go back to our
events, if we had
the column for here in the events, it's going to show us which event handler
generated that event.
So again, back at the event handlers, here's the beautiful default list. I don
't think I've
created any from scratch. In fact, we can confirm that by going to more. And
then I'll go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then I'll go ahead and
say just show custom and I have no yet custom event handlers. I'm just going to
show us our
predefined event handlers. And there are hundreds of them. We can also go ahead
and use the gear,
of course, to add or remove columns. So I'm going to clean this up a little bit
, remove some columns
that we're not using at the moment. Some event handlers can go ahead and
automatically create an
instant for us. I'm going to remove that for the moment as well from columns.
And I'm also going
to remove the notification profile for the moment. And let's see if that gives
us a little more real
estate to work with. And let me also go ahead and collapse the left hand side WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
estate to work with. And let me also go ahead and collapse the left hand side
to under incident
and events event handlers. So let me go ahead and collapse the left hand side.
Fantastic. And
let me show you how you can visually identify a basic event handler, which is
matching on any of
the rules in that event handler versus a correlation event handler. So this
icon right here looks like
a little notebook with a set of rules. That's the icon that I'm pointing to
right now for a basic
event handler. And let's go ahead and take a look at this one right here as an
example. So this
default botnet communication detection has a whole bunch of rules. Let's go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
default botnet communication detection has a whole bunch of rules. Let's go
ahead and double
click on it to take a closer look. So there's the name, the description, it has
some minor tech
IDs that's associated with. We'll take a closer look at that as well as we
continue. If we scroll
down here are all the rules. Now with a basic event handler as shown right up
here, any of these
rules matching is going to effectively trigger with this event handler. And it
's going to create
an event. So if a system had traffic from their device going to a command and
control network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
control network,
and it was blocked by the 40 gate and shown in a virus log, that would trigger
on this one.
Or if it showed up as detected in a virus log where it was identified but not
stopped,
that would also trigger. That's this rule right here. Or if the DNS query for a
command and control
website was blocked, that would trigger on this rule, etc, etc. And we can also
see the details by
expanding each of those right here. And if we wanted to, we could also go ahead
and edit. However,
it's probably a better idea if we want to tweak or modify to go ahead and clone
an existing event WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
an existing event
handler and then make our own and tweak it. There's also good news, the option
if we disable some
and then realize later, Oh, we need that. We can go ahead after we save it. I
'll click on OK to save
that. And then later, if we decide we need to set that back, we can go ahead
and double click on it
to edit it and then click right here on factory reset, which will set them all
back. We'll click
on OK, and then just double check. Sure enough, they're all set. And we'll
change it again. I'll go
ahead and disable these three top rules. Just an example, click on OK. Another
way of resetting
it is to select this, which is right here. And then from the more option, click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it is to select this, which is right here. And then from the more option, click
on factory reset,
and looking for enforcement, we're going to reset this event handler. We'll
click on OK. Then if
you go back in, once again, it's restored to its defaults. Or if you got kind
of crazy and change
five or six, you can select five or six. And then from the menu here, you could
go ahead more
and factory reset and click on OK. So again, this icon right here is the icon
for a basic event
handler. And let's compare and contrast that to a correlation event handler. So
let's go down
and let's find, let's go ahead and do another be fun. I hope this one right WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's find, let's go ahead and do another be fun. I hope this one right
here, that'd be great.
So this is the icon right here. It looks a little puzzle. So puzzle has
multiple pieces. And the
implication there is that with a correlation event handler, we have a whole
bunch of stuff
that happens together or with a certain timeframe. So that's the icon for a
correlation event handler,
like a correlation of log or messages that happen. And it triggers. So let's
take a look at this
one right here. We'll open it up. So this right here, here's the correlation
sequence. It's looking
for five failed login attempts followed by login success. And when it sees that
, it's going to go
ahead and it's going to trigger. And thank goodness, we don't have to write all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and it's going to trigger. And thank goodness, we don't have to write all
these ourselves because
can be kind of tricky narrowing it down to exactly what you're looking for. And
by default,
there's tons and tons of event handlers, both basic and correlation event
handlers that can do
the job we want. And I would recommend that if you need a customized event
handler, maybe take
one that's close to what you need, and then tweak it rather than creating it
all from scratch. So
this is an example of the details for a correlation event handler. Again,
thinking of multiple events
that have to happen in sequence or together or within a timeframe. And if we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that have to happen in sequence or together or within a timeframe. And if we
look at another
basic one, like at that icon right here, we'll go and open it up. It simply
means that any of
these rules, if they're matched, are going to trigger. And as a result, it's
going to go ahead
and create an event. All right, let me cancel that. Another cool thing is that
if we create an event
handler, and we want to share that with another administrative domain, there's
a great option for
taking one right here, for example, let's imagine this is a custom one. And
[garbled], this is clone one.
Let's go ahead and let's clone this one right here. So we'll clone it. We'll
call it our cloned
event handler. And we'll click on OK. And let's go ahead and do more here and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event handler. And we'll click on OK. And let's go ahead and do more here and
say, let's just show
our custom ones. And there it is. So there's our clone one. We can also create
a new one and put
in all the details either way. If we wanted to share that with administrators,
for example,
in a different administrative domain, we could go ahead and export it. So here,
with that selected,
we click on more and click on export, we could go ahead and include any details
we wanted to here,
and then choose the format, text, CLI or zip, click OK, it'll save that for us.
And then what we could
do on the other side is send it over to them, and they could go ahead and do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do on the other side is send it over to them, and they could go ahead and do
the import. So I'll
click OK there. I'll save that to my downloads folder. And then just for
granted, I'm going to
right click and delete that one. We'll pretend we're in a different
administrative domain. In fact,
we don't have to pretend. Let's go ahead and do it. We have eight arms set up.
So we'll go back to
BR one ADOM, and currently has no custom event handlers. So let's go ahead and
do it import by
going to more and import. So I'll go ahead and drag and drop it right there.
And boom, there it is
in the new ADOM. So we have this one here now in this BR one dash ADOM. If we
go back to our root ADOM, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go back to our root ADOM,
it's not there anymore because I deleted it. But we get imported here again as
well by going to more
import and importing that custom event handler, which I'll do right now. It's
just by drag and
dropping, clicking OK, and boom, it's now there again. And because we don't
need it, I'm going to
right click and go ahead and delete it. So let me go ahead and click on OK, and
then more, and I'll
click on show predefined, and we're back to square one. So let me demonstrate
how an event handler
in action is working. So let's go ahead and just bring back the left hand side
here. Let's go to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here. Let's go to
event monitor. And I'm going to specify for the last five minutes. Oh, import
40 analyzer config
fail. What happened there? I don't know. So it went south. So we could
investigate that, or we could
right click on it and suppress it and click on OK, I'm just going to right
click and acknowledge it
and click on OK. And that way we don't have to look at them. So in a production
environment, I'd
take a closer look at that to make sure it's not something critical. But for
now in this demo,
I'm OK with that. Okay, so on to the demonstration. So for the last five
minutes here, we're looking at
the event monitor. And currently in our event handlers, let's go ahead and take WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the event monitor. And currently in our event handlers, let's go ahead and take
a default one
that we can trigger. So right here, this is great. Default botnet communication
detection.
And so the rules are any of these, if they match is going to go ahead and
trigger based on this
event handler and create a new event. So let's go ahead and do a DNS resolution
for a domain name
that's associated with botnet or command and control network. So to do that,
let's go over to
firewall one. And let's find one. So we're going to make a road trip right here
to firewall one.
And here at firewall one, my administrative session has expired. So I'll log WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here at firewall one, my administrative session has expired. So I'll log
back in. So here we are
at firewall one. And currently, if we go to policy and objects, in fact, we get
on to security profiles
and DNS, that might be a faster way to find it. So we have this DNS filter
called our DNS filter.
That's currently in use one time. So we'll click on that. And it is used with
our end out policy
with LDAP fantastic. And that's the one that's being matched on quite a bit. Or
at least it will
be by one of our clients going through the firewall. So let's go ahead and open
up that profile by
double clicking on it. So currently, this DNS filter profile is redirecting bot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
double clicking on it. So currently, this DNS filter profile is redirecting bot
net command and
control request to the block portal. And there's over 8000 domains in the bot
net package. Great.
So let's go ahead and let's click on the botnet package. And let's do some
tests. So I should be
able to try to resolve any of these names from one of our clients behind the
firewall. And that
should show up in the logs. And if it shows up in the logs, those send over to
40 analyzer,
it should trigger based on that event handler. So I'm gonna go ahead and grab
PC to here,
which is behind firewall to, which is fording traffic through firewall one to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is behind firewall to, which is fording traffic through firewall one to
get to the public
internet. So we can test some name resolution for domains associated with
command and control
networks right here. So here is PC to let's open up a effect. Let's do a
command line.
Actually, I don't really want to try to go to any, um, you know, URL, which are
botnet,
command and control, but I don't mind resolving their names. So let's go ahead
and use NS lookup,
or we could also use dig, I think as well. Let's use NS lookup. So we'll type
it in
this lookup, we'll go into interactive mode. And let me bring in our list of
domains. So here is our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
domains. So here is our
list of domains that are identified in the 40 gate. So let's go ahead and let's
try a few that are
maybe some safer work ones. Let's go ahead and let's do the combat shell. So
resolve combat shell
dot com and sure enough, that's being redirected. So that's hitting there. And
let's take one other
one. How about office RSVP? So office dot RSVP. That's also being redirected.
Great, great, great,
great. You know, it's the same addresses for IPV four and IPV six. And that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
great. You know, it's the same addresses for IPV four and IPV six. And that's
the 40 gate firewall
firewall one doing that redirection. So let me go ahead and click on cancel
there and scroll down.
And sure enough, for IPV four, I specified the redirect IPV four, dress of 1040
, 0100. All right,
let me go ahead and click on cancel there. And let's go back now to the 40
analyzer. So back
of the 40 analyzer under instant events and event handlers, this specific event
handler
should have just been triggered. So to see whether or not it actually did its
work and created an
event, let's go back to event monitor. And for the last five minutes and sure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event, let's go back to event monitor. And for the last five minutes and sure
enough, there's office
RSVP and combat shell. It's also showing us right here in the handler, the
exact handler that
caused it. So we click on the hyperlink for that handler. It'll also show us
specifically which
rule was matched as part of that handler that caused that event to be generated
. So here we
could right click and go ahead and assign it. Let's go ahead and assign it to
myself. Logged
on as an event, click OK, so so right click and add a comment that this is for
a demo. That way
other administrators, if they look at it, not that they will on this lab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
other administrators, if they look at it, not that they will on this lab
environment, but that way
your other team members can see your comments and messages will click on OK.
And we can right click
here as well and go ahead and view the logs. So there's our log entry that came
over from firewall
one and we'll double click on it. And this one was for the quad a record. So we
'll go ahead and
double click on it. There's our log message will open it up. And there's the
details on that
DNS request or another way of looking at that would be to right click and then
go to log view.
And that'll take us to a new tab or new window in 40 analyzer under log view WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that'll take us to a new tab or new window in 40 analyzer under log view
logs with that specific
filter put in place. So here we can see that we have the a record for IPv4 as
well as the
quad a record that we're being requested. And if we needed more detail, we
could actually
specify this log and go to more and say, you know what, I want to see the raw
log and look at all
the individual details, which can be helpful if we're trying to dig down to
what's really going on
or if we need to create an event handler, we could use some of this information
in the raw log
to go ahead and create our own custom event handler. So this is for the a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to go ahead and create our own custom event handler. So this is for the a
record here. And this is the
IPv6 quad a record here. And these are the log entries of the 40 gate sent over
to the 40 analyzer
where the event handler saw them and as a result, created the event. So we
close this tab, we'll go
back to our original pane here. And just to foreshadow in our next skill that
we're going to cover
is the next logical step then would be to also take events that we're concerned
about and right
click on them and then create a brand new instant. Think of an instant like a
ticket that we can then
do more analysis on and investigation on and add notes to and add reports on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do more analysis on and investigation on and add notes to and add reports on
and so forth to help
identify what's really going on on the network and to lock down any security
vulnerabilities or
problems that we may be having. And again, we'll cover incidents in that next
logical step in a
separate skill. So in summary, event handlers are going to be looking based on
a set of rules
at the log information that's coming in and then based on their rules matching,
they would go ahead
and create an event. And the one we just triggered was this one right here. And
this is the event
handler responsible for creating the events that we just looked at.